5/15/23, 12:01 PM Access control lists - Win32 apps | Microsoft Learn

Access control lists

Article02/08/2023

An access control list (ACL) is a list of access control entries (ACE). Each ACE in an ACL identifies
a trustee and specifies the access rights allowed, denied, or audited for that trustee. The security
descriptor for a securable object can contain two types of ACLs: a DACL and an SACL.

A discretionary access control list (DACL) identifies the trustees that are allowed or denied access to a
securable object. When a process tries to access a securable object, the system checks the ACEs in the
object's DACL to determine whether to grant access to it. If the object doesn't have a DACL, the system
grants full access to everyone. If the object's DACL has no ACEs, the system denies all attempts to
access the object because the DACL doesn't allow any access rights. The system checks the ACEs in
sequence until it finds one or more ACEs that allow all the requested access rights, or until any of the
requested access rights are denied. For more information, see How DACLs control access to an object.
For information about how to properly create a DACL, see Creating a DACL.

A system access control list (SACL) allows administrators to log attempts to access a secured object.
Each ACE specifies the types of access attempts by a specified trustee that cause the system to
generate a record in the security event log. An ACE in an SACL can generate audit records when an
access attempt fails, when it succeeds, or both. For more information about SACLs, see Audit
generation and SACL access right.

Don't try to work directly with the contents of an ACL. To ensure that ACLs are semantically correct,
use the appropriate functions to create and manipulate ACLs. For more information, see Getting
information from an ACL and Creating or modifying an ACL.

ACLs also provide access control to Microsoft Active Directory service objects. Active Directory Service
Interfaces (ADSI) include routines to create and modify the contents of these ACLs. For more
information, see Controlling object access in Active Directory Domain Services.

https://learn.microsoft.com/en-us/windows/win32/secauthz/access-control-lists?redirectedfrom=MSDN 1/1